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ABSTRACT 



We simulate quantum key distribution (QKD) experimental setups and give out some 
improvement for QKD procedures. A new data post-processing protocol is introduced, 
mainly including error correction and privacy amplification. This protocol combines 
the ideas of GLLP and the decoy states, which essentially only requires to turn up 
and down the source power. We propose a practical way to perform the decoy state 
method, which mainly follows the idea of Lo's decoy state. A new data post-processing 
protocol is then developed for the QKD scheme with the decoy state. We first study 
the optimal expected photon number ji of the source for the improved QKD scheme. 
We get the new optimal /i = 0(1) comparing with former ji = 0(r)), where i] is 
the overall transmission emciency. With this protocol, we can then improve the key 
generation rate from quadratic of transmission emciency 0{rf) to 0(r)). Based on 
the recent experimental setup, we obtain the maximum secure transmission distance 
of over 140 km. 



1. INTRODUCTION 



Quantum key distribution (QKD) |2| allows two parties, commonly called Alice, 
the transmitter and Bob, the receiver, to create a random secret key with the channel 
revealed to the eavesdropper, Eve. The security of QKD is built on the fundamental 
laws of physics in contrast to existing key distribution schemes that are based on 
unproven còmput ational assumptions. 

The best-known QKD scheme was proposed by Bennett and Brassard in 1984 
(commonly called BB84 protocol) pQ. Alice uses a quantum channel, which is gov- 
erned by quantum mechanics to trànsit single photons, each in one of four polariza- 
tions: horizontal (0°), vertical (90°), 45°, 135°. Bob randomly chooses one of two 
bases: rectangular (+) or diagonal (x) to measure the arrived signals, and keeps the 
result privately. Consequently, Alice and Bob compare the bases they use and dis- 
card those in different bases. At last, Alice and Bob perform the local operations and 
classical Communications (LOCC) to do the data post-processing, which is mainly 
composed of error correction and privacy amplification [3J HJ |S] . Our report will im- 
prove the procedure of BB84 with decoy state jü], [7] and apply the idea of GLLP jS] 
to develop a new post-processing protocol. 

The security of the idealized QKD system has been proven in the past few years 
jÜJ HJ Now let us turn our attention to the experiment. Real setup is no longer 
ideal, but with imperfect sources, noisy channels and inefhcient detectors, which will 
affect the security of the QKD system. 

A weak coherent state is commonly used as the photon source, which is essentially 
a mixture of states with Poisson distribution of photon number. Thus, there is a non- 
zero probability to get a state with more than one photon. Then Eve may suppress 
the quantum state and keep one photon of the state that has more than one photon 
(commonly called multi photon, correspondingly, single photon denotes the state with 
only one photon). Moreover, Eve may block the single photon state, split the multi 
photon state and improve the transmission efficiency with her superior technologies 
to compensate the loss of blocking single photon. Without the technology to identify 
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the photon numbers, Alice and Bob have to pessimistically assume all the states lost 
in the transmission and detection are single photons. In this way, the secure expected 
photon number fi of the signal state is roughly given by, \i — 0(rf), which implies that 
the key generation rate R = 0(rj 2 ), details can be found in section 0] and Appendix 
A. 

The inefficiency of the detector will also affect the security of the QKD system. 
There exists a so-called dark count in the realistic detectors, which will increase the 
error rate of detection especially when the transmission efficiency is low. The dark 
count of a detector denotes the probability to get detection events when there is no 
input to the detector. Eve may use this imperfection to cover the error she introduces 
from her measurement of the single photon state. 

In the recent paper GYS [TD] . the authors conducted an experiment in which 
the single photon was transmitted over 120 km. The question is whether the QKD 
experiment reported in GYS is secure or not? Unfortunately, based on the prior art of 
post-processing scheme, it is insecure. GYS uses the expected photon number \i = 0.1 
as the source, which will be defeated by so-called photon number splitting attack in 
long distance. All in all, there exists a gap between the theory and experiment. Here, 
we are attempting to bridge the theory and experiment. 

The key problem here is that Bob does not know whether his detection events 
come from: single photon, multi photon, or dark count. To solve this problem, we 
apply the idea of decoy state to learn the performance of single photon states. The 
decoy state here acts as a "scope" telling Alice and Bob which state comes from single 
photon, multi photon or dark count. 

Our result is significant because it is a bridge between the theory and experiment 
of QKD. we extend the secure distance of the QKD system, increase the key gener- 
ation rate substantially and maintain the major advantage of QKD — unconditional 
security. We improve the key generation rate from 0(rj 2 ) to 0(rj). Notice that such 
a key generation rate is the highest order that any QKD system can achieve. Our 
improvement is mainly based on an advanced theory. We do not require any enhance- 
ment of equipment but only turning up and down the source power, which is easy to 
implement with current technology. 

We notice that Koashi [Tj] has also proposed a method to extend the distance 
of secure QKD. It will be interesting to compare the power and limitations of our 
approach with that of Koashi. 
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The outline of this report is as follows. In section|2]we will recali to the proof of the 
security of an idealized QKD system with entanglement distillation protocol (EDP). 
In section we shall review a couple of widely used QKD setups and simulates them 
following ^21- In section we shall investigate the former post-processing schemes 
with the simulation and point out the limitation of prior art. We find out that the 
key generation rate R is 0(r] 2 ), where r] is the overall transmission efficiency In 
section we combine the idea of GLLP [H] and decoy state [üj [7] , and improve the 
key generation rate from 0{rf) to 0{rj). In Appendix A, we discuss the choosing of 
the optimal expected photon number /i, which maximizes the key generation rate. In 
Appendix B, we introduce a practical way to perform weak decoy state, which is a 
key step of the decoy state method. 



2. EDP SCHEMES FOR QKD 



In this section we will recali the security proof of the idealized QKD with EDP 
[T3J EH EU Hj- The security of BB84 scheme can be reduced to the security of the 
Entanglement Distillation Protocol (EDP) schemes jü]. 

In the EDP protocol, Alice creates n + m pairs of qubits, each in the state 



the eigenstate with eigenvalue 1 of the two commuting operators X ÇZ) X and Z ^ Z, 
where 



sacrifice m randomly selected pairs to test the error rates in the X and Z bases by 
measuring X (^) X and Z (^) Z. If the error rate is too high, they abort the protocol. 
Otherwise, they conduct the EDP, extracting k high-fidelity pairs from the n noisy 
pairs. Finally, Alice and Bob both measure Z on each of these pairs, producing a 
k-bit shared random key about which Eve has negligible information. The protocol 
is secure because the EDP removes Eve's entanglement with the pairs, leaving her 
negligible knowledge about the outcome of the measurements by Alice and Bob. 

A QKD protocol based on a CSS-like EDP can be reduced to a "prepare-and- 
measure" protocol 0. CSS code ^H] conducts error correction to the bit error and 
the phase error separately. That is to say, CSS-like EDP deals with the error correc- 
tion and privacy amplification separately, which can be further improved by two-way 
communication [Tü]. Thus the residue of this data post-processing protocol is the 
so-called CSS rate, 



I^> = ^(|00> + |11», 




are the Pauli operators. Then she sends half of each pair to Bob. Alice and Bob 





x\og 2 (x) - (1 -x)log 2 (l -x). 



2. EDP schemes for QKD 



7 



In summary, there are two main parts of EDP, bit flip error correction (for error 
correction) and phase flip error correction (for privacy amplification). These two steps 
can be understood as follows. First Alice and Bob apply bi-direction error correction, 
after which they share the same key strings but Eve may still keep some information 
about the key. Alice and Bob then perform the privacy amplification to expunge Eve's 
information from the key. The final key will be secure if the privacy amplification 
is successfully done in principle. That is Alice and Bob do not need to actually do 
the privacy amplification but only ensure that this can be done. In practice, Alice 
and Bob can calculate the residue of the privacy amplification and perform random 
hashing to get the final key with high security. 



3. SIMULATIONS FOR EXPERIMENTS 



To simulate a real-life QKD system, we need to model the source, channel and de- 
tector. In this section, we first review the real experimental setup, and then simulate 
the QKD system following [12], at last verify the simulation with real experimental 
data. 

3.1 QKD setup 

Let us recali the principle of the so-called p&p auto-compensating setup [d HE], where 
the key is encoded in the phase between two pulses trading from Bob to Alice and back 
(see Fig. 13. A strong làser pulse emitted from Bob is separated by a first 50/50 
beam splitter (BS). The two pulses impinge on the input ports of a polarization beam 
splitter (PBS), after having traveled through a short arm and a long arm, including 
a phase modulator (PMb) and a delay line (DL), respectively. All fibers and optical 
elements at Bob are polarization maintaining. The linear polarization is rotated by 
90° in the short arm, therefore the two pulses exit Bob's setup by the same port of the 
PBS. The pulses travel down to Alice, are reflected on a Faraday mirror, attenuated, 
and come back orthogonally polarized. In turn, both pulses now take the other path 
at Bob and arrive at the same time at the BS where they interfere. Then, they are 
detected either in Di, or after passing through the circulator (C) in D 2 . Since the 
two pulses take the same path, inside Bob in reversed order, this interferometer is 
auto-compensated. |IH| 

To implement the BB84 protocol, Alice applies a phase shift of or 7r and tt/2 or 
37r/2 on the second pulse with PM^. Bob chooses the measurement basis by applying 
a or tt/2 shift on the first pulse on its way back. 18 

As for the free-space QKD system, the setup is easier. There are only encoded 
signals which come from Alice's side to Bob's, comparing with the p&p setup, the 
pulses traveling from Bob to Alice and back. In this sense, the free-space setup is 
closer to the original BB84 schemes. More details of this kind of QKD setup can be 
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Fig. 3.1: Schematic of the p&p prototype. This figure comes from [T%] 
found in [El EDI EU- 

3.2 Modeling the real-life QKD system 

Following prior papers such as [12], we simulate the p&p QKD system. The first 
important parameter for the real-life QKD system is the key bit rate B between Alice 
and Bob. More explicitly, B is the number of exchanged key bits per second, given 
by 

B = uR, (3.1) 

where v is the repetition frequency in Alice's side, and R is the key generation rate, 
i.e. the number of exchange bits per pulse, given by 

R = qpDVpost, (3.2) 

where q depends on the implementation (1/2 for the BB84 protocol, because half the 
time Alice and Bob disagree with the bases, and if one uses the efficient BB84 protocol 
[22], one can have q ~ 1), pr> is the average number of signals per pulse detected by 
Bob, and r] post denotes for the residue of data post-processing, i.e. the efficiency of 
error correction and privacy amplification, which is also discussed in section [2] Eq. 
()2.1j) . We will study po in the following and discuss r] post in the section 0] and El 

For optical fibers, the losses in the quantum channel can be derived from the loss 
coefficient a measured in dB/km and the length of the fiber l in km. The channel 
transmission íab can be expressed as 

t AB = 10~w. 

Let rjBob denote for the internal transmission tsob and detection efficiency i]d in Bob's 
side, given by 

VBob — tBobVD- 
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Then the overall transmission and detection efíiciency between Alice and Bob r] is 
given by 

T) = t A BVBob- (3.3) 

The average number of signals per pulse detected by Bob, i.e. the probability for 
Bob to get a signal from his detector pp, is given by 

PD = VSignal + Pdark ~ PSignalPdark ^ 
= P Signal T Pd ark 5 

where we assume that the dark counts are independent of the signal photon detection. 
Pdark and psignai are the probabilities to get a dark count and to detect a photon 
originally emitted by Alice respectively. 

The dark count depends on the characteristics of the photon detectors. The effect 
of dark count will be significant when rjfi is small which implies psignai is small. It 
is necessary to point out that Pdark is the overall dark count throughout the QKD 
system. Here we consider the p&p QKD setup, Pdark is twice as large as Úb because 
there are two sources of dark count, i.e. two detectors in the QKD system. Then the 
Pdark is given by 

Pdark = 2ob, 

where ds denotes the dark count of one detector. 

Normally, a weak coherent state is used as the signal source. Assuming that the 
phase of this signal is totally randomized, the number of photons of the signal state 
follows a Poisson distribution with a parameter /1 as its expected photon number. In 
appendix B, we will discuss the optimal value of expected photon number /i which 

optimizes the key generation rate R. psignai is given by 

00 j 

PSignal = ^ ' T ^PÍ - ^)' ( 3 " 5 ) 

where rji is the transmission efliciency of i-photon state in a normal channel. It is 
reasonable to assume independence between the behaviors of the i photons. Therefore 
the transmission efliciency of i-photon state rji is given by 

t/í = 1 - (1 - vY- (3-6) 
Substitute into (|3.5|) . we have, 

PSignal = Yj} ~ (1 ~ VY] "TT 6Xp( jl) 

l=í ú (3.7) 

= 1 — 6Xp(— TjfjL). 
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We can divide psignai into two parts ps and pm, which are the probabilities of 
single photon and multi photon states emitted from Alice's side that are detected by 
Bob. Then (|3.4|) is given by, 

PD = Pdark +Ps+Pm ^ ^ 

= Pdark + 1 - e~ W . 

The overall quantum bit error rate (QBER, denoted by 5) is an important param- 
eter for error correction and privacy amplification r] post . QBER is equivalent to the 
ratio of the probability of getting a false detection to the total probability of detection 
per pulse. It comes from three parts: dark count, single photon and multi photon, 

r \pdark + S S PS + hlPM /„ n x 

6=^ , (3.9) 

Pd 

where ós and 6m denote the error rate of single and multi photon detection, respec- 
tively. The dark counts occur randomly, thus the error rate of dark count is ~. 

Due to the high loss in the channel, the multi photon states arriving at Bob's side 
always has only one photon left. Thus, we have the similar probability of erroneous 
detection for single photon and multi photon. The bit error rate Ss and Sm are given 
by, 

$M — &S = ^detector, (3.10) 

where tdetectar is the probability that a photon hit the erroneous detector, tdetector 
characterizes the quality of the optical alignment of the polarization maintaining 
components and the stability of the fiber link [T^]. It can be measured with strong 
pulses, by always applying the same phases and measuring the ratio of the count rates 
at the two detectors. In our discussion, we neglect e<fe tector 's dependence of the fiber 
length because the change of alignment during the transmission of a signal is very 
small. 

Substituting (EHUI) into í[3~Ü]l . QBER is given by, 

£ "^Pdark ^detectorP Signal ^ íí) 

Pd 

There is another important parameter for privacy amplification, the ratio of single 
photon detection in overall detection events fi which is defined by, 

fi = — - (3-12) 

Pd 

Only the key extracted from the single photon state can be secure. Thus, f\ • Pd 
roughly gives the upper bound of the key generation rate. 
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3.3 Verify the simul&tion by QBER 

Here we would like to verify the equations ()3.11|) by comparing the experimental 
result and our simulation. The parameters of the experimental setup are listed in 
Tab. EHJ 





T8[23j 


G13 24 


KTH[25J 


GYS[IÜ1 


Wavelength [nm] 


830 


1300 


1550 


1550 


q [dB/km] 


2.5 


0.32 


0.2 


0.21 


t B [dB] 


8 


3.2 


1 


5* 


^detector [%] 


1 


0.14 


1 


3.3 


d B [per slot] 


5 x íir 8 


8.2 x 10" 5 


2 x 10" 4 


8.5 x 10" 7 


VD [%] 


50 


17 


18 


12* 



Tab. 3.1: Key parameters for p&p QKD experiment setup. * GYS gives out that rjBob = 
0.045. 

Fig. 13.21 shows QBER as a function of expected photon number \i. For /i valuing 
in the range 10 _1 ~ 10 -4 , the QBER has a constant value of about 1% that is 
dominated by depolarization-induced errors tdetectar- These errors arise from dynamic 
depolarization that results from the finite extinction ratios of the various polarizing 
components in the system For /i < 10~ 4 the QBER rises as the dark counts 

falling within the detectors start to become the dominant contribution to the noise. 

QBER as a function of expected photon number u 
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10 5 10^ 10 J 10 2 10 ' 10° 

Expected photon number u 

Fig. 3.2: shows QBER as a function of input expected photon number using Eq. (|3.11j) . 

reproducing T8's Fig 3. The key parameters are, according to T8 |23j . listed in 
Tab. I3.ll and the fiber loss is 3dB (~ 1.5km). 



\ Data come from T8 

~\ Fiber loss: 3dB 

\ Receiver connector loss: 8dB 

\ Detector efficiency: 50% 
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Fig. IH.HI shows QBER as a function of transmission distance using Eq. In 
the long distance (l > lOOkm, say), the QBER rises as the dark counts become the 
dominant contribution to the noise. Note the exponential dependence is due to the 
loss of photons in the propagation, referring to psignai of Eq. (|3.7|) . If stronger source 
(say, /i = 0.5) is used, QBER will be lower, especially in the long distance region. 



QBER as a function of Transmission Distance 




50 100 150 

Transmission Distance [km] 



Fig. 3.3: shows QBER as a function of the transmission distance, using the Eq. (j3.11|) . This 
is a reproduction of FIG. 3 in GYS' paper ^üj. The key parameters are, according 
to GYS [Ell, listed in Tab. I3.ll The expected photon number [i is 0.1. 



From these verifications, we can see that the Eq. (JH.llj) fits the experiment well, 
so the simulation is accurate. 



4. OUR COMPARISON OF PRIOR ART RESULTS 



Now, we begin to examine the relationship between key generation rate R and the 
transmission distance with prior QKD data post-processing schemes. Two ideas in 
Lütkenhaus' paper [T2] and GLLP's paper jH] are compared. Note that it is our new 
work to calculate the key generation rate R with the experimental simulation using 
the idea of GLLP 0. 

In both papers, the authors are going on the assumption that all of the photons 
that fail to arrive were emitted as single photons. Later, we will improve this point 
by introducing the decoy states scheme. Assuming that, 

Paí = S M , (4.1) 

where Sm is the probability of emitting a multi photon state from Alice's side, which 
is dependent on attribute of the source. Based on the Poisson distribution of the 
number of photons of the signal states, 

S M = 1 - (1 + //) exp(-/i). 

Another assumption used here is that all the error (QBER) comes from the single 
photon state. Then the error rate of single photon is given by, 

Ss = y- (4-2) 

For individual attacks, the residue of error correction and privacy amplification 
can be given by [T2j . 

Vpost =max{A(l - log 2 [l + ^ -4(j-) 2 ]) 

h h (4.3) 

- f(5)H 2 (5),0}, 

where f(5) > 1 is the efficiency of error correction listed in Tab. 14.11 5 is the 
QBER given in equation (|3.11|) . f\ is defined in (J3.12J) . 

We would like to explain the idea of GLLP's [S] tagged state briefly here. Notice 
the idea of tagged state is (perhaps implicitly) introduced by j2Z]. In principle, one 
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5 


0.01 


0.05 


0.1 


0.15 


i(S) 


1.16 


1.16 


1.22 


1.35 



Tab. 4.1: The data come from 12 j. The author used used the upper bounds for 1(4) provided 

in üg. 

can separate the tagged and untagged states, i.e. one can do random hashing for the 
privacy amplification on the tagged state and untagged state separately. Therefore, 
the data post-processing can be performed as following. First, apply error correction 
to the overall states, sacrificing a fraction H 2 {5 ) of the key, which is represented in 
the first term of formula (|4.4jl . After correcting errors in the sifted key string, one 
can imagine executing privacy amplification on two different strings, the sifted key 
bits Stagged arising from the tagged qubits and the sifted key bits s unta gged arising from 
the untagged qubits. Since the privacy amplification [B] is linear (the private key can 
be computed by applying the C 2 parity check matrix to the sifted key after error 
correction), the key obtained is the bitwise XOR 

Suntagged © Stagged 

of keys that could be obtained from the tagged and untagged bits separately. If 
Suntagged is private and random, then it doesn't matter if Eve knows everything about 
Stagged — the suïn is still private and random. Therefore we ask if privacy amplifi- 
cation is successful applied to the untagged bits alone. Thus, the residue after error 
correction and privacy amplification can be expressed as, 

Vpost = max{- f(5)H 2 (6) - /i(l - H 2 £)), 0}. (4.4) 

Ji 

Here the single photon state is regarded as the untagged state and its error rate 
(S b = S p ) is given by (Q. 

Based on (|3.2|) . ()4.3|) and ([4.4)1 . according to Appendix B, the optimal expected 
photon number //, which maximizes the key generation rate, is roughly given by, 

\i « 77, (4.5) 

where 77 is the overall transmission, defined in the (|3.3|) . Therefore, the key generation 
rate is given by, 

R = 0{r)n) = 0{jf). (4.6) 
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Now, use (|4.5jl as the expected photon number to calculate the key generation rate 
of two different schemes by equation ()4.3|) and (|4.4|) with Lütkenhaus' and GLLP's 
post-processing protocols. 

Fig. 14.11 shows the relationship between key generation rate and the transmission 
distance by one-way LOCC, comparing Lütkenhaus' individual attack and GLLP's 
general attack case. From the Fig. 14.11 we can see that GLLP is only slightly worse 
than Lütkenhaus', but GLLP deal with the general attack while Lütkenhaus' result 
is restricted in individual attack. Our result shows that there seems to be little to 
be gained in restricting security analysis to individual attacks, given that the two 
papers — Lütkenhaus vs GLLP — gave very similar results. In other words, our view 
is that one is better off in considering unconditional security, rather than restricting 
one's attention to a restricted class of attacks (such as individual attacks). Note that 
the key generation rate R of GYS with GLLP will strictly hit at distance l = 34km. 



The key generation rate as a function of distance 

rr 2 p 1 1 1 1 1 1 




10 1 1 1 1 1 1 1 1 

5 10 15 20 25 30 35 40 

Transmission distance [km] 

Fig. 4.1: shows the relationship between key generation rate and the transmission distance, 
comparing Lütkenhaus' individual attack and GLLP's general attack case. The 
key parameters are listed in Tab. 13.11 It is our new work to calculate the key 
generation rate R with the experiment simulation using the idea of GLLP 8 . 



5. DECOY STATE METHOD 



So far as discussed, the prior art gives Eve many ideal advantages such as she can make 
the tagged state no error and no loss in the channel, however, this is not necessary. 
We can control Eve's performance on tagged states by adding decoy states. "Control" 
does not mean limit the quantum or classical computation ability of Eve, but means 
we can detect Eve if she uses some eavesdropping strategies to enforce the tagged 
states. 



The decoy state method is proposed by Hwang [ü] and further studied by [7j. The 
idea is that, by adding some decoy states, one can estimate the behavior of vacua, 
single photon states, and multi photon states individually. 

The key point is that, with the decoy state, Alice and Bob can gain photon 
number information which cannot be derived by today's technologies directly. They 
can use this extra information to "detect" the behavior of states with different photon 
numbers. Eve cannot distinguish whether the photon comes from signal state or decoy 
state. Thus, the transmission efficiency {rji}, detection probabilities and error rates 
(ds, Sm) in the signal state will be the same as those in decoy state, 



where i = 1, 2, 3 • • ■ . 

Our decoy state method is quite different from Hwang's original one. Hwang uses 
strong pulse as decoy state. We mainly follow [Tj's decoy idea, using vacua and very 
weak state as decoy states. 



5. 1 The idea of decoy state 



r]i(Signal) 
Ss(Signal) 
ÒM^Signal) 



7]i(Decoy) 
5 s (Decoy) 
S M (Decoy), 
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5.2 Simulation with new assumption 

With the decoy states, we can drop the "pessimistic" assumption (|4.ip . According to 
Poisson distribution of photon source, the single photon and multi photon detection 
probabilities are given by 

p s = r]fiexp(—fi) (5.1) 



PM = ^[l-(l-^]^e 

i=2 



(5.2) 



= 1 - - r]/2e~^, 

where /i is the expected photon number and rj is the overall transmission and detection 
emciency, defined in (jl·l.Hjl . The transmission efficiency of an i-photon state rji is given 
by (Q. 

We remark that the Eqs. (j5-H) and ()5.2j) do not consider dark count contributions. 
In real-life, dark count contributions must be included. Therefore, following Eq. (|3.4|) . 
we write down the total contribution (true signals plus dark counts) as follows, 

Pdark Pdark& ^ 

Ps =Ps+ Pdark^e'* 1 (5-3) 

PM = PM + Pdark[l - (1 + /i)e~ M ] 

and the error rate of dark count is still |, for single photon and multi photon, 

nPdark ^detectorPS 



S s 



Pdark + PS /g ^ 



S hpdark + ^detectorPM 

5 M = 1 ■ • 

Pdarfc + PM 

5.3 A way to perform decoy state 

Here we would like to introduce a specific method to perform decoy state, which is 
proposed by [7j. There are three kind of signals Alice and Bob should perform. 

First, Alice and Bob can study the dark counts by using vacua as decoy states. 
Here we reasonably assume that the density matrix of dark counts is the ídentíty 
matrix. Thus, in theory, they will detect the probability to get a signal ·p°g cua and the 
overall error rate S vacua , 

vacua cyj 

PD — Pdark ~ ^ a B 

1 (5-5) 

^jvacua _ 

~ 2' 
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They can measure p v £ cua and S vacua via experimental methods and then compare 
with the Eq. (j5.5|) . If the experimental results match the Eq. ([5.5(1 . then keep going. 
Otherwise, they need to check out the QKD system setup, especially the detectors. 

Secondly, Alice and Bob can get the transmission and the bit flip error rate of the 
single photon state by using very weak coherent states as decoy states. With weak 
decoy state, according to ([3.8(1 and ([3.110 . p^ eafc and S weak are given by, 

weak i weak , weak 

PD — Pdark T Ps T Pm 



cweak 



\pdark + 5 S pT ak + ÒMPZ ak 



!r rujeak 

Pd 



where the superscript weak denotes the value comes from weak decoy state. In ap- 
pendix B, we will discuss the how to choose \i weak in practice. 

If the decoy state is weak enough, i.e. ^ weak <c 1, at which value 

n weak 

%-k = 0(^ eak ) « 1, (5.7) 
Ps 

we can neglect the multi photon terms in Eq. (J5.6j) . After that we have 

weak weak 

PS ~ PD Pdark, 

and substitute this formula into ([5.3j) . ([5.4jl . 



= Pl^ - PdarkH ~ H™ ak e-» Weak ) 
= pT k - Pdarke-^" 

£ Weak 1 _^weak 

OweakP £) ~oPdark& 



(5. 



6, 



r^weak 

Ps 



where Pdark can be derived from the Eq. (J5.5|) . and p^ eafc ; 5 wea k can be obtained from 
the experiment. 

Thirdly, Alice and Bob perform the signal state, where the final key is drawn from. 
The detection probability pd and QBER 5 are given by ([3.8(1 and ([3.11(1 . 



5.4 Data post-processing 

Here, we would like to discuss the data post-processing for QKD with the decoy state, 
mainly based on jH]. 

We can further extend the GLLP's idea [Sj, as discussed in section|H to more than 
one kind of tagged states case, i.e. several kinds of states with flag g. The procedure 
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of data post-processing is similar, do the overall error correction first and then apply 
the privacy amplification to each case. At last the residue of error correction and 
privacy amplification is given by, 

Vpost = m a x{-f(5 b )H 2 (5 b ) + £y[l - H 2 (5 9 p )],0} (5.9) 

9 

where one need to sum over all cases with flag g, p 9 is the probability of the case with 
flag g and ó^ is the phase flip error rate of the state with flag g 

In order to combine the ideas of GLLP and Decoy, we should find out all parame- 
ters for Eq. ()5.9|) . There are three kind of states in the discussion, dark count, single 
photon, and multi photon. The multi photon state emitting out of the source can 
be expressed by 1 000) + |111). After Eve gets the extra photon, the state will be a 
mixture of 1 00) + |11) and 1 00) — |11) with the same probability. Thus the phase flip 
error rate for multi photon will be \. In addition to the discussion in 15.21 we can list 
the bit flip error rate ó b and phase flip error rate ó p for dark count, single photon and 
multi photon in Tab. 15.11 





Dark count 


Single Photon 


Multi Photon 


ó b 


i 

2 


ós 


ÓM 


ó p 


1 
2 


ós 


1 

2 



Tab. 5.1: Bit flip error rate and phase flip error rate for different kinds of photon state. 

Apply above idea, Eq. (J5.9|) . to decoy states scheme with the parameters listed in 
Tab. 15.11 We get the formula for post-processing residue, 

Vpost = max{-f(ó b )H 2 (ó b ) + ^[1 - H 2 (8 S )],0} (5.10) 

Pd 

where ps and ós are given by ()5.3|) . ()5.4|) . Note that the dark count and multi photon 
state have no contribution to the final key with phase flip error rate ó p = |. The 
reason why we use ps and ós here is that Bob cannot distinguish the detection event 
from real signal or dark count. And substitute ()5.10|) into the equation (jH.2j) . if the 
key generation rate is R > 0, 

R = l -{-p D f{ó)H 2 {5) +p s [l - H 2 (ó s )}} (5.11) 

where ó is the overall QBER given in (j3.11|) . 
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Through the analysis in Appendix B, we have, for the KTH experimental 
setup, fioptimai ~ 0.8 and for GYS [10 , fioptimai ~ 0.5. Therefore, the key generation 
rate is given by, 

R = 0(r)ii) = 0(r}) (5.12) 
The result is shown in Fig l5.ll 

The key generation rate as a function of distance 



10" 





I GYS 






^ Upper bound 








k - ^ using fi=1 










Asymptotic li ne 






gnore the effect 






of dark count 

-I - 




l GLLPwithout GLLP+Decoy ^ 








decoy state using ji=0.5 








: using [i=n 


\ 






Further improvecL__^ 


\ 
1 






by two-way LOCC 







20 40 60 80 100 120 140 160 180 200 
Transmission distance [km] 



Fig. 5.1: shows the key generation rate as a function of the transmission distance, 
GLLP+Decoy Eq. (|5.11|) . The key parameters are listed in Tab. 13.11 and f(e) 
is given by Tab. 14.11 We use linear regression for f(e). 

Remarks for the figure: 

1. The dashed line is the upper bound of the key generation rate. The key gener- 
ation rate here is derived from the photon detection events of Bob that occur 
when Alice sends single photon signals. It is to say, Bob can distinguish dark 
count, single photon, and multi photon. In this way the upper bound of key 
generation rate is given by, 

Rmax — ~ H 2\ e detector))- 

It is obvious that the optimal expected photon number for the upper bound is 
fi = 1. The gap between the upper bound and the decoy curve shows how much 
room is left for improvements of data post-processing. 

2. The dotted line is the asymptotic line that neglects the influence of dark count, 
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which is given by, 



Ra. 



sym 



PD 



-PDÍ{e d etector (^detector ) 

+ p s [l - H 2 {e detector )} 
l-exp(?7/i), 



3. The "decoy" and "without decoy" line will hit zero at some points. This can 
be seen from the formula (J5.11|) . R = when, 



From the program (as shown in figure), when / = 144/cm for GLLP+Decoy, and 
l = Ukm for GLLP, R will hit 0. 

4. One can further improve the data post-processing protocol with two-way LOCC 
[Tü] . As shown in Fig J5.ll dashed curve outside of decoy curve, two-way LOCC 
improve the maximum distance by about 20 km. 

Compare the curves with and without decoy, we can find that the advantages of 
decoy state are obvious, 

1. The initial key generation rate (at zero distance) is substantially higher with 
decoy state than without. It is because a stronger source (higher /i) is used in 
the decoy state scheme. 

2. At short distances, the key generation rate decreases with distance exponentially 
mainly due to exponential losses in the channel. The two curves, with and 
without decoy state behave like straight lines. Note that the initial slope without 
decoy is twice of that with decoy state. This is because without decoy state, 
R = 0(i] 2 ), while with decoy state, R = 0(r]) according to (|4.b|) and (|5.12j) . 

3. Suppose 10~ 6 is the cut-off point for key generation rate. The two curves in- 
tercept the cut-off point at rather different locations (with decoy: 139 km, and 
without decoy: 31 km). For GYS, the distance is over lOOkm. It is compa- 
rable to the distance between amplifiers in optical metropolitan area networks 
(MANs). 
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Here, we would like to discuss the key bit rate B, which is different from behavior 
with key generation rate R only with a constant, repetition frequency, according to 
Eq. í)3.1|) . It is necessary to point out that there are two repetition freqüències in real- 
life setups: the source frequency u^, which is the limitation of signal source repetition 
at Alice's side and the detection rate Ub, which is the limitation of detector's count 
rate in Bob's side. There are two cases we should consider. First, when the overall 
transmission loss is not too large, the detection frequency vb limits the final key bit 
rate, because we can complement the loss in the transmission through increasing the 
source frequency v& until reaches u^s màxima. In this case, B is simply given by, 
B = vb- Secondly, when the overall transmission loss is large, B is determined by 
the source rate z/4. Then the key bit rate B is given by í)3.ip . B = uaR- 

We remark that the decoy state idea can also be used for free-space QKD setup 

. The simulation of the setup will be similar. 



CONCLUSION 



In this report, we have presented a security proof of quantum cryptography against 
the general attack with real-life devices. We have formulated a method for estimating 
the key generation rate in the presence of realistic devices by combining the idea of 
decoy state and GLLP. The model has been applied to various real-life experimental 
setups. Based on recent experiment results, secure transmission distance of the QKD 
system can be up to 140 km. 

We have improved the key generation rate substantially. The main reason for this 
improvement is that with decoy state we can choose the expected photon number \i 
of source in the order of 0(1), while without decoy state, \i = Oijf). With the decoy 
state, a new data post-processing protocol is developed, which essentially comes from 
the idea of GLLP. We have also proposed a pratical way to fulfills the ideal of decoy 
state as discussed in section lo~ïïl and Appendix B. In this sense, it can help to design 
the QKD procedure. 

Through the simulation, it is clearly shown that, in order to improve the transmis- 
sion distance, one should reduce the dark count and fiber loss in the channel; as for 
the aim of higher key bit rate, we should increase the detection repetition or reduce 
the errors in the transmission. 
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6. APPENDIX A 



In this section, we will discuss the choosing of the expected photon number \x for 
different error correction and privacy amplification schemes in section HJ |S| We will 
discuss the optimal /i generally and then work out reasonable value for each scheme. 

We would like to start with genèric discussion. On one hand, we need to maximize 
the probability of single photon detection, which is the only source for the final key 
To achieve this point, we should maximize the single photon sources since transmis- 
sion efficiency is fixed. Considering the real photon sources, according to Poisson 
distribution of the photon number, the single photon source reaches its maximum 
when fi = 1. On the other hand, we have to control the probability of multi photon 
detection to ensure the security of the system. On this side, we should keep the 
tagged states ratio (1 — f\) small, which requires \i not too large. It follows that 
/i < 1, because based on both points, the case of /i > 1 is always worse than the 
case of n = 1, And another parameter should be considered is the QBER 5, which 
is decrease when /i increases, according to the formulas (j3.11|) . Therefore, intuitively 
we have that, 

/xe (0,1]. 

6. 1 Without decoy state 

Here, we would like to consider the case without decoy state, i.e. GLLP and Lütkenhaus's 
cases. A similar discussion is given in [TJ] . We desire to get an optimal value of \i that 
maximizes the key generation rate R with other parameters fixed. The key parame- 
ters here are the overall transmission and detection efficiency i], dark count ds, and 
the probability of erroneous detection ed etector , which are specified by various setups. 

In the R-distance figures, such as Fig. I4.1l and l5.ll the key generation rate drops 
roughly exponentially with the transmission distance before it starts to drop faster due 
to the increasing influence of the dark counts. The initial behavior is mainly due to 
the multi-photon component of the signals while the influence of the error-correction 
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part is small. In this regime we can bound the gain by the approximation 

R < ^(P Signat ~ Pm) 

with the pessimistic assumption (|4.1|) . This expression is optimized if we choose 

/i = HOptimal, Which fulfills 

— /iexp(— ji) + r]exp(—r]fi) = 0. 
Since for a realistic setup we expect that 77/i -C 1, we find 

VOptimal ~V- (6-1) 

Now, we can use the numerical analysis to verify the formula (jfi.l)) . When we keep 
all parameters fixed and vary the expected photon number \i of the signal, then we can 
use dichotomy method to find out the fMopümah which maximizes the key generation 
rate by the formula (|3.2j) and í)4.4jl . If we fix the dark count and the probability 
of erroneous detection edetector-, and vary the transmission efficiency 7] we can draw 
the relationship between the optimal fioptimai and 77. The result is shown in Fig. 16.11 
from which we can clearly see that the formula (j6.1|) is a good approximation. 



The optimal ]x as a function of n. 




1^ ' ' ' ' ' ' ' ' ' 1 

0.02 0.04 0.06 0.06 0.1 0.12 0.14 0.16 0.18 0.2 
The overall transmission efficiency if 



Fig. 6.1: Optimal expected photon number fi as a function of transmission efficiency 77, with 
the parameters listed in Tab. 13.11 T8 Here, we use dichotomy method to 

search the region to get the optimal [i that maximizes the key generation rate ()3.2|) 
and l(Ojl . 
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6.2 With decoy state 

In principle, with the decoy state, we can control the performance of tagged states. 
So Hoptimai should maximize the untagged states ratio /i, as defined in ()3.12|) . Thus, 
Hoptimai should be greater than 

If we keep all parameters fixed and vary the expected photon number of the signal, 
we can obtain a key generation rate curve with a clear maximum. The key generation 
rate is given by (|5.11j) . 

We would like to start with numerical analysis on (J5.ll)) directly. For each distance 
we find out the optimal fi that maximizes the key generation rate. The result is shown 
in Fig. 16.21 The strange behavior of the curve around l = 125/cm is due to the linear 
regression of error correction efficiency f(e) given in Tab. 14.11 Without f(e), the curve 
will be smooth. We can see that the optimal fi for GYS is around 0.5. 

The optimal \í as a function of distance 
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Fig. 6.2: Using numerical analysis to obtain the optimal key generation rate by the formula 
í)5.11|) and use the data GYS in Tab. 13.11 with parameters listed in Tab. 13.11 

Now, we would like to do analytical discussion under some approximation. We 
neglect the dark count, regard r\ <C 1, and consider the ideal error correction efficiency 
/(e) = 1. Then (jïïSD , (EU), (EHTJ) will be reduced to, 

Ps=Ps = Vl· íe ~ >x 

$S — OS = e detector 
PD = PSignal = 1 ~ e""" 
— ^detector 
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Substitute these formulas into Eq. the key generation rate is given by, 

R ~ ^{-^^(edetecíor) + r?//e~ M [l ~ H 2 (e detector )]} 



The expression is optimized if we choose \i = Hoptimai which fulfills, 

(1 - fi) exp(-/i) 



í^2( e detector) 



1 — H2\e detector 

Then we can solve this equation and obtain that, 

KTH ^ _g 



l·^Optimal 
f^Optimal 



GYS „ Q >5 



where for KTH setup e detector = 1%, and for GYS e detector = 3.3%. Comparing two 
results we can see that numerical and analytical analysis are compatible. 



7. APPENDIX B 



In section l5~ïïl we use a weak decoy state. Here we would like to discuss how to perforin 
decoy state method in practice. 

In decoy method, we require the weak decoy state to be "weak enough" i.e. its 
expected photon number /i < 1, We can then neglect the multi photon term by 
considering the relationship ([5.7)1 . However, it is not practical for real experiment 
since it will take a long time to get enough information from weak decoy state if 
H < 1. 

Here we propose one possible solution for weak decoy state, using several (say m) 
weak decoy states with expected photon number //i,/i2, • • -^m, instead of one. As 
discussed in ÍI5.5|) . one can estimate the dark count and its error rate accurately. Let 
us turn our attention to m weak decoy states. With the same argument of ([5.6)1 . we 
have, 

oo i 

pïj = Pdark + ^ ( 7 - 1 ) 

i=l 

where j = 1,2, • • -,m denotes for the j-th weak decoy state. To solve Eq. ([7.1)1 . we 
can neglect the high order (> m) terms which are of 0(/x m+1 ), and then Eq. ([7.1)1 
are reduced to, 

P# 
P% 

Pd 1 

Now, one can solve m equations for i = 1, 2, 3, ■ ■ -, m. The subsequent procedure 
is the same as the 15.31 One can use r\ = rji to calculate ps and 5s by ([5.3)) and ([5.4)1 . 
At last substitute the parameters into ([5.11)) to calculate the key generation rate. 



m j 
i=0 

m j 
i=0 

m j 

= E*-T- e "* 

i=0 
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How many decoy states should be applied, i.e. m =?, depends on how low expected 
photon number \i wea k one can tolerate. Here, we would like to give out a couple of 
examples. Given that rj = 10~ 4 , suppose that all m decoy states are in the same 
order. a) If one chooses \i wea k = 0(1CT 3 ) and m = 2, then the terms neglected are of 
O(10~ 9 ) and p s is in the term of 0(rjii) = 0(1CT 7 ). Then it is reasonable to neglect 
the multi photon terms. b) If one chooses [i wea k = 0(1CT 2 ) and m — 3, then the 
high order terms neglected are of 0(1CT 8 ) and ps is in the term of 0(r//x) = 0(1CT 6 ). 
Then, one obtains ps and 5s with precision of around 1%. 
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